can't auth against domain with group